VulnerabilityAnalyzed
CVE-2026-22922
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access.
MEDIUM 6.5EPSS 0.39%
Does this matter?
Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.
Description
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.39% probability · 32th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-648
- Affected
- apache/airflow
- Source
- security@apache.org
References
- https://github.com/apache/airflow/pull/60412Issue Tracking, Patch
- https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/02/09/2Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.